[NMOP] draft-cabanillas-nmop-policy-sharing-model

[LUCIA CABANILLAS RODRIGUEZ <[e-mail]>]

Hello,

Following the feedback we have received, we have made several updates to the Policy Sharing Model draft. https://datatracker.ietf.org/doc/draft-cabanillas-nmop-policy-sharing-model/

The main change is that we have generalized the scope from authorization policy sharing to policy sharing. The model is now explicitly policy-language agnostic: the YANG artifact carries policy metadata and opaque policy content, while YANG identity/identityref is used to incorporate different policy languages without modifying the base schema. Rego, Cedar, ALFA, and XACML are currently included as examples, but the model is not tied to any specific language.

In addition, we are coordinating with the AuthZEN Policy Store work<https://htmlpreview.github.io/?https://github.com/nynymike/AuthZen_Policy_Store/blob/main/draft-schwartz-authzen-policy-store.html#name-relationship-to-nmop-policy>. Their draft explicitly addresses its relationship with the NMOP Policy Sharing Model and the separation of responsibilities between policy-store governance and policy distribution. We have therefore added a corresponding reference in our draft. The two efforts are complementary: AuthZEN addresses the policy-store side, while our NMOP work focuses on individual policy artifacts and their distribution across domains.

For the next Hackathon, we will demonstrate the model in a multi-domain scenario involving heterogeneous policy languages and enforcement technologies.

The demonstration will involve two domains:

  *
In the first domain, an OPA-based PDP will receive and evaluate policies expressed in Rego.
  *
In the second domain, a controller will receive a policy based on RFC 9061<https://www.rfc-editor.org/info/rfc9061/>. The policy will specify that communication between two particular nodes must be established through an IPsec tunnel with a specified level of encryption. After distributing the policy to that domain, we will demonstrate its enforcement by showing that communication between those nodes is established through the required IPsec tunnel.

The goal of the demonstration is to show that the same policy-sharing framework can distribute and manage policies across heterogeneous domains, even when the policy languages, semantics, and enforcement mechanisms differ. One domain will consume a Rego policy evaluated by OPA, while the other will consume a network security policy that results in the establishment of an IPsec tunnel.

Comments and suggestions on both the updated draft and the Hackathon demonstration are very welcome.

Best regards,
Lucía

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is confidential and privileged information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição